Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Quietly Mandates Enterprise Certificate Auto-Enrollment
Transcript
- Lucas: If your enterprise is still relying on self-signed certificates or manual certificate enrollment for Wi-Fi, VPN, or email encryption, Windows 11 is about to force a change. And it's not a minor policy tweak — it's a fundamental shift in how devices authenticate on your network. Luna: You're talking about certificate auto-enrollment, right? I've seen some murmurs in IT forums, but Microsoft hasn't made a huge noise about this one. Lucas: Exactly. Certificate auto-enrollment has been a feature in Windows Server since Windows Server 2008, but Microsoft never mandated it for domain-joined machines. With Windows 11 — specifically the 24H2 update expected later this year — devices connected to Azure AD or hybrid Azure AD will require certificate auto-enrollment for core identity scenarios. The old fallback of password-based authentication or manually installed certificates is being deprecated. Luna: So this isn't just a recommendation — it's a hard requirement? What's the actual trigger? Lucas: The trigger is a change in the Windows 11 security baseline. Starting with 24H2, Microsoft is updating the 'Certificate Services Client — Auto-Enrollment' policy to be enabled by default for devices that are Azure ad joined. If you don't have a PKI infrastructure — either Active Directory Certificate Services or a third-party CA like DigiCert or GlobalSign — your devices simply won't get the certificates they need to authenticate for things like Wi-Fi 802.1X, VPN IKEv2, or S/MIME email signing. Luna: Let me guess: this is going to hit a lot of mid-size enterprises that have been running on self-signed certs or nothing at all. Lucas: That's exactly the group that's going to feel the pain. I've been talking to a few IT admins, and a common scenario is a company that set up Azure AD Connect for hybrid identity but never deployed ADCS. They're using self-signed certificates on their NPS server for RADIUS authentication, and they manually distribute root certificates via Group Policy. Windows 11 24H2 will reject those manual configurations if the auto-enrollment policy isn't properly configured. Luna: What about the big enterprises that already have a mature PKI? Is this still a headache for them? Lucas: Even for them, there are implications. A lot of large enterprises have multiple certificate templates, some of which might not be set to auto-enroll. They'll need to audit every template and make sure the 'Enroll subject' permission and auto-enrollment flag are correctly applied. Plus, the auto-enrollment renewal process is changing — certificates will be renewed up to 90 days before expiration, but only if the device has network access to the CA. For laptops that are frequently off-network, that's a real operational challenge. Luna: So the laptop that sits in a suitcase for three months — it comes back, connects to the network, and its certificate might already be expired, right? Lucas: Exactly. And in that scenario, auto-enrollment won't help because the device can't authenticate to the network to get the certificate. It's a chicken and egg problem. Microsoft's answer is to use certificate enrollment via web enrollment or NDES — Network Device Enrollment Service — which can work over the internet. But that requires additional infrastructure and firewall rules. Luna: Let's talk about the three biggest pain points you're hearing from IT teams. What are they? Lucas: Number one is network access — Wi-Fi and VPN. If your enterprise uses 802.1X with eap tls, which is the standard for certificate-based authentication, the client needs a machine certificate issued by your CA. Without auto-enrollment, the machine can't get that cert, and it can't connect to the network. I've seen a mid-size healthcare firm that discovered 40% of their laptops were still using password-based Wi-Fi profiles. Those machines will simply fail to connect after the 24H2 update. Luna: Forty percent — that's a massive blind spot. And number two? Lucas: Email encryption with S/MIME. If your organization uses S/MIME for signing or encrypting emails, Outlook on Windows 11 will require a certificate that's enrolled via auto-enrollment. Manual certificate import or legacy enrollment methods are being deprecated. That means your executives might suddenly be unable to send signed emails after the update. And because S/MIME certificates are user-based, not machine-based, you need to ensure user certificate auto-enrollment is also configured properly. Luna: And number three is application authentication, I'm guessing — things like smart card logon or client authentication for internal web apps? Lucas: Bingo. Many organizations use certificates for client authentication to internal portals, web services, or even line of business applications. If those certs aren't enrolled via auto-enrollment, and the application relies on the certificate's chain of trust, the application will break. I've heard of one financial services firm where their CRM system uses client certificates for API access. They had to scramble to set up auto-enrollment for all their users before a pilot rollout of Windows 11. Luna: So what should an IT team do right now? It's June 2026 — 24H2 is probably in preview or rolling out soon. Lucas: First step: audit your current certificate infrastructure. Identify all the places where certificates are used for authentication — Wi-Fi, VPN, email, applications. Map out whether those certificates are enrolled manually, via Group Policy, or via auto-enrollment. Second step: deploy or upgrade your PKI. If you don't have ADCS, consider installing it on a Windows Server 2022 or 2025 machine. Configure the certificate templates with the 'Autoenroll' permission for the appropriate security groups. Luna: And for the chicken and egg problem with off-network laptops? Lucas: That's the third step: implement a web enrollment solution — either Microsoft's NDES or a third-party product like Keyfactor or GlobalSign. This allows devices to enroll certificates over the internet without requiring network authentication first. You'll also need to ensure your firewall allows HTTPS traffic to the NDES server from external IPs. Fourth step: test with a small pilot group of Windows 11 machines. Deploy the 24H2 preview, enable the auto-enrollment policy, and verify that machines can get certificates and connect to all your services. Luna: I imagine many IT teams are going to discover that their current certificate lifecycle management is… let's say, ad hoc. Lucas: Ad hoc is generous. I've seen organizations where certificates are issued with ten-year validity and never rotated. Auto-enrollment enforces a two-year maximum by default, and you can configure shorter periods. That means you need a process to track and renew certificates. If you don't have a monitoring tool — something as simple as a script that checks certificate expiration — you're going to face outages. Luna: One thing that strikes me is how this ties into Microsoft's broader push toward cloud-only identity. They've been deprecating NTLM, they're pushing cloud Kerberos trust, and now certificate auto-enrollment becomes mandatory. It feels like the final nail in the coffin for legacy on-premises authentication. Lucas: That's exactly the play. Microsoft wants every device to have a unique, verifiable identity in the cloud. Certificates are the backbone of that. The deprecation of NTLM and the move to cloud Kerberos are part of the same story — eliminate passwords and shared secrets wherever possible. Certificate auto-enrollment is the mechanism that makes it scalable. If you're still using passwords for Wi-Fi or VPN, you're an outlier, and Microsoft is making that very uncomfortable. Luna: Before we wrap up, I want to circle back to something you mentioned earlier — the healthcare firm with 40% of laptops on password-based Wi-Fi. How did they handle the migration? Lucas: They had to do a manual audit of every laptop. They used a PowerShell script to check the wireless profiles on each machine and flag any that used WPA2-Personal or WPA3-SAE. Then they created a new GPO to deploy the correct 802.1X profile with certificate authentication. But because they didn't have a PKI, they had to stand up ADCS first. The whole project took about three months. The lesson is: start now, because 24H2 is going to enforce this, and the remediation can take longer than you'd expect. Luna: That's a great practical takeaway. Let's talk about the show for a second. We keep these episodes ad-free because we believe the content should stand on its own. If today's conversation gave you a usable roadmap — or saved you from a future help desk ticket — and you want to support that mission, the link is buy me a coffee dot com slash fexingo. It's a small gesture that helps us keep the episodes independent. Lucas: Absolutely. No ads, no sponsors, just the analysis. If you find value in that, we appreciate the support. Luna: So, back to the certificate story — one more thing that I think is worth highlighting. For IT teams that already use Microsoft Intune, there's actually a smoother path. Intune supports certificate enrollment via SCEP, and you can configure that without on-premises ADCS using a third-party CA or even the Microsoft Intune Certificate Connector. So if you're already in a cloud-native management model, this might be less disruptive. Lucas: That's a great point. Intune's SCEP profile is a valid alternative for devices that are managed purely via MDM. But for hybrid-joined devices that still rely on on-premises Group Policy, you'll need ADCS. The key is to understand your management model and test accordingly. I'd recommend every IT admin run a report of their Windows 11 devices and check whether the 'Certificate Services Client — Auto-Enrollment' policy is enabled. If it's not, assume it will be enforced by 24H2 and plan for it. Luna: And the timeline — when should teams have this in place? Lucas: If you're targeting the 24H2 broad rollout, which typically happens in the fall, you want your PKI infrastructure ready by August at the latest. That gives you time for pilot testing and remediation. But I'd say the earlier the better — start auditing this month. Certificate infrastructure is one of those things that always takes longer than you think because it touches so many systems. Luna: Final thought — is there any scenario where an organization can opt out of this requirement? Lucas: Not really. Microsoft's security baseline is becoming the default, and while you can override it with custom policy settings, that's not a sustainable path. Overrides get flagged in security audits, and they'll likely be removed in future updates. The safest bet is to embrace auto-enrollment and invest in your PKI. It's not just about compliance — it genuinely improves your security posture by eliminating shared secrets and enabling strong device identity. Luna: Well said. I think that's a solid note to end on. Thanks, Lucas. Lucas: Thanks, Luna. And to our listeners — go check your certificate templates. You'll thank yourself later.